IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1 . (Currently Amended) A method for identifying network traffic comprising: 

receiving pattern matching data; 

comparing the pattern matching data with a patt e rn each of a plurality of 
patterns ; , 

for each pattern, determining whether the pattern matching data matches 
the pattern; and 

for each pattern that the pattern matching data is determined to match, 
including a pattern match score corresponding to the pattern in an application protocol 
score associated with an application protocol with which the pattern is associated, 
wherein the application protocol comprises one of a plurality of application protocols and 
each pattern is associated with a corresponding one of the plurality of application 
protocols; and 

concluding bas e d at l e ast in part on a d e t e rmination that th e patt e rn 
matching data match e s th e patt e rn that a network traffic with which the pattern matching 
data is associated is associated with [[an]] a determined application protocol with which 
th e patt e rn is associated that has a highest application protocol score among the plurality 
of application protocols . 

2. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
pattern matching data includes application data. 



Application Serial No. 10/628,006 
Attorney Docket No. SYMAP027 



2 



3. (Original) A method for identifying network traffic as recited in Claim 1 , in the event that 
the pattern matching data matches the pattern, further including determining a property 
associated with the network traffic. 

4. (Canceled) 

5. (Original) A method for identifying network traffic as recited in Claim 1, in the event that 
the data matches the pattern, further including determining a property associated with the data 
and assigning a score for the property. 

6. (Original) A method for identifying network traffic as recited in Claim 1, in the event that 
the data matches the pattern, further including determining a property associated with the data; 
and applying a policy based on the property. 

7. (Canceled) 

8. (Canceled) 

9. (Canceled) 

10. (Original) A method for identifying network traffic as recited in Claim 1, wherein the 
pattern matching data includes a string selected from a packet. 

1 1 . (Original) A method for identifying network traffic as recited in Claim 1 , wherein pattern 
matching data includes concatenated application data of a plurality of packets. 

12. (Original) A method for identifying network traffic as recited in Claim 1 , wherein the 
pattern includes a regular expression. 

13. (Original) A method for identifying network traffic as recited in Claim 1 , wherein the 
pattern includes application protocol information. 

14. (Original) A method for identifying network traffic as recited in Claim 1 , wherein the 
pattern includes commonly used port information. 
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15. (Original) A method for identifying network traffic as recited in Claim 1, in the event the 
data does not match the pattern, further comprising returning a failure indicator. 

16. (Original) A method for identifying network traffic as recited in Claim 1, wherein 
determining whether the pattern matching data matches the pattern occurs at the beginning of 
session. 

1 7. (Original) A method for identifying network traffic as recited in Claim 1 , wherein 
comparing the pattern matching data with a pattern is performed for each received data. 

18. (Canceled) 

19. (Canceled) 

20. (Currently Amended) A system for identifying network traffic comprising: 

an interface configured to receive pattern matching data; 
a processor configured to: 

compare the pattern matching data with a patt e rn each of a 
plurality of patterns ; 

for each pattern, determine whether the pattern matching data 
matches the pattern; and 

for each pattern that the pattern matching data is determined to 
match, include a pattern match score corresponding to the pattern in an 
application protocol score associated with an application protocol with which the 
pattern is associated, wherein the application protocol comprises one of a plurality 
of application protocols and each pattern is associated with a corresponding one 
of the plurality of application protocols; and 

conclude based at least in part on a determination that th e patt e rn 
matching data match e s th e patt e rn that a network traffic with which the pattern 
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matching data is associated is associated with [[an]] a determined application 
protocol with which the patt e rn is associat e d that has a highest application 
protocol score among the plurality of application protocols . 
21 . (Currently Amended) A computer program product for identifying network traffic, the 
computer program product being embodied in a computer readable medium and comprising 
computer instructions for: 

receiving pattern matching data; 

comparing the pattern matching data with a patt e rn each of a plurality of 

patterns ; 

for each pattern, determining whether the pattern matching data matches 
the pattern; and 

for each pattern that the pattern matching data is determined to match, 
including a pattern match score corresponding to the pattern in an application protocol 
score associated with an application protocol with which the pattern is associated, 
wherein the application protocol comprises one of a plurality of application protocols and 
each pattern is associated with a corresponding one of the plurality of application 
protocols: and 

concluding bas e d at l e ast in part on a d e t e rmination that th e patt e rn 
matching data match e s the patt e rn that a network traffic with which the pattern matching 
data is associated is associated with [[an]] a determined application protocol with which 
th e pattern is associated that has a highest application protocol score among the plurality 
of application protocols . 

. 22. (Canceled) 
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